Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
24/03/2025, 06:05
General
-
Target
1 (289).exe
-
Size
41KB
-
MD5
6ae78c148db3cabcefdb47f68cbee6b0
-
SHA1
fcfa2a015c0095ab19401be6e9697e9721db3e98
-
SHA256
5f644b8f7997bad7534d764946a88cbcb408ed9bbc0c3d08090a8ff926e83a39
-
SHA512
a14b1e5a6631cce8057dac1911cf28250d4b89cdb0a6415148cdb06f42ab9fe9c8a27f4a7c7087a190be606b1cd16fce9e877b9470dab6a4347e089cfa991d91
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/y:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1 (289).exe"C:\Users\Admin\AppData\Local\Temp\1 (289).exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD59495e447114ef084102e999d7c64ac34
SHA1cdbd3e5e0391557cf2be023ad53eba0e69fc289e
SHA25666a4adb330260350c8c8b72567e930ad6e740c774024337b3919d0c880edd2a5
SHA5124003e11c54c1f8ae840988fa16ee7c1c8b5efa27b972567ec365c1e79f041e17c8d980321ae23e2388c1d476c15c314cd6f9e6749025e68c1bf512d01b7c6873
-
Filesize
41KB
MD52d4cf5d0dbced7c1ee4189440069f344
SHA148f0469f9cc861c52b01aa8c9ca1d08faf2cd46f
SHA2565a2d54af2ac1448272ac32a296f92a90c7584363303bfb9ad2c20b8514d11459
SHA512575fbc2343d93cd7e32809d3ae5b38eda5e643d247b0cc70326a5859ead4634c1eeb5e4bac081926b74a5c498e8ff7197646cffccfb04e210663ecc3c49576f8
-
Filesize
192B
MD5759c40d2ef25d9cd7377bfdb9a76026d
SHA18418e9725e4ce7dea809b245d5ae2ebc06fc340a
SHA25650b8c1c32d095e67be85cd885c1dadb8082db6ef5bd8fed66216a64b224c47a9
SHA512beac66af196ecc9e73158b06d73ad521c50c36321cba61c9203bb9ccca72b399fe09133276c0aa100b7c883069c480e100c4d507013de4ed13426b34d6cc757e
-
Filesize
192B
MD5acbada7295a80de0ac36f8f6f5f168d9
SHA1f9235bb1a5a049412a1cc371da47c0f6d793f816
SHA2566045b4d3c2b748a8f75456e6bf79b78a99ca7fb4b9f476db5c2357021a48744b
SHA512381f1ba995747f22c0a200e70979dfc17763a685b33a06ea26ff19813434dc5670263a0bc90a1e811fb28732ccfbe2a33983f2a60e4cedb437140db31f38b725
-
Filesize
192B
MD5ad2b76879672b0bcf5aa2c9b8ee64710
SHA18fe490dbd66c2bea0a16fe37e4da205534230c81
SHA256f4cb159d2188a3caa56e29dc854820a2c5cb7ef32cab12f35e97ff0beb5de175
SHA5121ff1ca2d032715e63ed3bb6201e5a68d5e9a907372eedf3ab31e0b1c88dad5922b522642c65fd5f6b8edc9f5d6b508d34b2e24e5db9092271af4e9704bb83509
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB